Harden gateway connectivity, session renewal and capability recovery

[Proxicon]

The owner’s admitted native clients repeatedly reset near 60 seconds. RC.19 already proves the default Traefik incoming body-read deadline in its disposable A/B fixture and supplies a streaming-listener reference. This PR corrects independent product lifetime defects and preserves an active terminal through routine authenticated renewal. The terminating live hop remains unknown: no running ingress configuration or owner hosts were available, and no deployed configuration was applied.

• Bound presence bootstrap, heartbeat I/O and cleanup; commit provisional actor admission only on the first valid heartbeat. Absolute admission deadlines, exact-attempt cancellation and bounded pending state prevent delayed admissions from displacing successors. Retry history resets after 120 seconds of validated health, with capped exponential delay and injectable jitter.
• Negotiate additive same-owner renewal using a fresh signed Agent JWT, strict expiry, matching tenant/agent/fence and current enrollment. Akka commits only serializable expiry and ordered state. Capability streams verify authoritative ownership across replicas; local leases only accelerate retirement. Rotate reconnect credentials after the ACK, align cache expiry with JWT expiry, and recheck absolute renewal time. Older peers retain their defined replacement/fencing outcome.
• Cancel physical terminal I/O, join bounded duplex workers, abort stalled transport and fence late delivery. Track and join file workers, gate successors behind unfinished cleanup, preserve partial-upload deletion and allowed roots, assign file sequence at the single FIFO reader, and bound saturated cancellation.
• Project readiness only for current authoritative online registrations. Recover safe folder queries after fresh readiness. Uncertain uploads, terminal input, commands and jobs are not automatically replayed; unexpected interruption reports the old terminal’s explicit fenced outcome and requires an explicit new shell.
• Extend the existing HTTPS/Traefik and nginx fixtures with real terminal process/state/input/output/resize, two signed renewals, integrity-checked files, a terminal opened near the old boundary, and one controlled interruption. Thirty deterministic reconnects check retired I/O, held child cleanup and bounded live calls/timers. Extend the existing log summarizer and provide the ingress inventory, conditional static patch, rollback and owner runbook.

Validation: all 21/21 applicable jobs passed in final-head Ready-event Actions, including disclosure, generic/visual gates, all native packages, all five image builds, the existing transport fixtures, both extracted PostgreSQL bundle browser lanes, OIDC, and previous-release upgrades. The preceding same-head run also passed all 21 jobs before this PR was made ready for review. Downloaded test/visual artifacts were checked against their Actions SHA-256 digests and source/merge metadata.

Hosted execution receipt	Passed / executed
API integration	20 / 20
Unit/runtime	2,227 / 2,227
Components	246 / 246
Generic Playwright	41 / 41
Complete generic suite	2,534 / 2,534
Windows offline	21 / 21
macOS offline	3 / 3
Sustained native gateway	1 / 1

All listed receipts have zero skipped or other nonsuccess results. SDK: 10.0.401. Existing nginx upload regressions pass 5/5 plus the sustained 65-second stream. The existing transport fixture retains its ~60-second default-Traefik negative control and 195-second direct/corrected positives with 14 ACKs. Real terminal process/state/I/O/resize and integrity-checked files remain usable through two signed same-owner JWT renewals. One controlled interruption records one initiating failure, bounded recovery, the old terminal's explicit fenced outcome, and a separately opened replacement. Thirty deterministic reconnects prove retired I/O and child cleanup complete before successors, with bounded live calls/timers; this does not claim an OS resource soak. The Compose setup assertion now waits for interactive readiness and retirement of the transient proof form, preserving its original assertions and 20-second limit.

• Source: 45620d027fc0b5ca0062044482b1913917f6a511
• Tested merge: fd31552e434d8550c1141baddb7a5120fe3997df
• Freshly fetched base: de56e25a21c1f642b749269f1332b8a7b41ef172

Baseline de56e25a21c1f642b749269f1332b8a7b41ef172 lifecycle reproductions executed 11 cases: 10 failed and one healthy-stream control passed. Upload browser baseline failed 4/5; the corrected existing nginx fixture passes 5/5 and its sustained 65-second stream passes. The runtime activation test protects already-correct first-heartbeat-before-extension behavior; deterministic midpoint jitter preserves the existing diagnostics delay assertions.

Deployed acceptance remains pending. The owner must capture the actual Gateway URL and TLS/proxy hops, ingress image digest, listener/routes/ports, effective limits and winning configuration source, plus correlated incident logs. Apply the documented minimal static change only to a confirmed conflicting listener. Use exact candidate Actions artifacts with the existing Windows/hv01/hv02 identities for a 30–45 minute functional run covering at least two normal renewals and one separately recorded controlled interruption, then one 12–13 hour three-host soak. Extend the initial run if token policy requires it. Record process uptime, presence availability and functional success separately. See the runbook.

Product version remains 0.1.0-rc.19. This request ends at review: no merge, tag, release or registry publication. Related to #138. Windows interactive helper acceptance remains separate from #156.